- The slides from AlxRogan’s “Protecting SCADA From the Ground Up” talk are now up here.
- Paul McMillan has a GitHub repo that contains the tools (but not, as far as I can tell, the presentation) from his talk, “Attacking the Internet of Things using Time“.
Archive for the ‘DEFCON 22’ Category
DEFCON 22 updates: August 12, 2014.
Tuesday, August 12th, 2014DEFCON 22 notes: August 11, 2014.
Monday, August 11th, 2014Yes, I know there was a gap yesterday. I was a little busy hanging out with friends, and I made the executive decision that I’d take a day off in hopes that more of Saturday and Sunday’s presentations would be uploaded.
Two things I want to make note of before jumping into links:
- This Ars Technica article summarizing Phil Zimmerman’s DEFCON talk.
- FARK had a link to an Orlando Sentinel (!) article about “a surprise appearance” by John McAfee. Here’s a link to the article. I haven’t found any coverage of this elsewhere. And, in my opinion, anything John McAfee says at this time should be taken with an entire lick of salt
.
With those out of the way, more links. If I link to a Black Hat version of a talk, it is because I am assuming it is very similar, if not identical, to the DEFCON version of the same talk. It seems like maybe there was a little more duplication this year…
- The team behind “Hack All The Things: 20 Devices in 45 Minutes” now has a Wiki page up with all the hacks for all the things. Hattip for this to Mike Szczys at Hack A Day, who did a write up on their presentation.
- I didn’t have this on my list, but Joe Grand’s “Deconstructing the Circuit Board Sandwich: Effective Techniques for PCB Reverse Engineering” is up over at Grand Idea Studio.
- The Black Hat version of Fatih Ozavci’s “VoIP Wars: Attack of the Cisco Phones” is here, including a PDF of the presentation and the source code.
- As far as I can tell, this was Black Hat only, not DEFCON, but I do want to mention it here: “When the Lights Go Out: Hacking Cisco EnergyWise“.
- I don’t think I ever threw up a full link to the Charlie Miller and Christopher Valasek presentation, “A Survey of Remote Automotive Attack Surfaces“, so here it is.
- Slides and the Mana toolkit from Dominic White and Ian de Villiers’ “Manna from Heaven: Improving the state of wireless rogue AP attacks“.
- The Black Hat version of Nir Valtman’s “A Journey to Protect Points-of-sale” can be found here.
- I don’t work as much with Windows as I used to, so this didn’t make my list. But if you’re interested, the Black Hat version of Ryan Kazanciyan and Matt Hastings’ talk on “Investigating PowerShell Attacks” is here. And here’s a brief article from PowerShell Magazine covering some of the same ground.
More updates later on tonight, I hope; otherwise, tomorrow.
DEFCON 22 notes: August 9, 2014.
Saturday, August 9th, 2014Here’s what I’ve been able to find so far:
- I haven’t found the actual presentation for “From root to SPECIAL: Pwning IBM Mainframes”. However, the scripts with explanations and usage examples are here. There’s also a GitHub repo with more resources here.
- Phil Polstra has the slides from his talk, “Am I Being Spied On? Low-tech Ways Of Detecting High-tech Surveillance” up here.
- The slides for Zoltan Balazs’ “Bypass firewalls, application white lists, secure remote desktops under 20 seconds” are located here.
DEFCON 22 updates: August 8, 2014.
Friday, August 8th, 2014Wired has an article based on the “Weaponizing Your Pets: The War Kitteh and the Denial of Service Dog” presentation which will take place on Sunday. I didn’t write about this yesterday because (and with all due respect to the presenter) it just didn’t strike me as being very interesting. You attached a WiFi scanner to a cat and let it roam around the neighborhood? Not sure I see anything novel there, except maybe if you made the WiFi rig very small. (You could have done the same thing with Kismet on a Nokia N810 years ago. You still can, if you can find a Nokia N810, which isn’t that hard, and if you can figure out a way to secure it to your pet.)
In other news, here are the presentation links I’ve been able to find so far. I’ll try to update this post during the day. If you are a presenter who would like your talk listed (even if it wasn’t on my list) or if there’s a talk you’d like for me to find, please feel free to leave comments or send email to stainles [at] sportsfirings.com.
- Pete Teoh’s “Data Protection 101 – Successes, Fails, and Fixes” talk is posted here.
- The Rick Mellendick and John Fulmer presentation, “RF Penetration Testing, Your Air Stinks” is here.
- I’m not sure if there is any difference between this version and the DEFCON one, but a version from May of the Sarah Edwards presentation, “Reverse Engineering Mac Malware”, can be found here.
- I haven’t yet found a copy of the presentation, but here’s a blog entry from Adam “Major Malfunction” Laurie on the RFIDler (from “RFIDler: SDR.RFID.FTW“). Here’s the GitHub repository. And here’s the Kickstarter.
That’s everything I’ve been able to find from yesterday. We’re only about 30 minutes into today’s sessions. And while looking for links, I ran across this tidbit: DEFCON ordered 14,000 badges this year. They were gone by 6 PM yesterday.
DEFCON 22: 0 day notes (part 2)
Thursday, August 7th, 2014So what’s happening on Friday?
“Domain Name Problems and Solutions” intrigues me the most in the first block, since a) it looks like this is going to involve DNS based attacks on spam, and II) Paul Vixie is one of the key figures in the development of DNS.
“USB for all!” sounds like an interesting talk: “We will demonstrate different tools and methods that can be used to monitor and abuse USB for malicious purposes.”
I would have to go to “From root to SPECIAL: Pwning IBM Mainframes” just because I have a close friend (and former IBM-er) who speaks IBM mainframe. Plus, I’m curious. But “ShareEnum: We Wrapped Samba So You Don’t Have To” would be a good second choice: “ShareEnum uses the underlying Samba client libraries to list shares, permissions, and even recurse down file trees gathering information including what is stored in each directory.” And “Stolen Data Markets An Economic and Organizational Assessment” could be interesting as well. I’d probably still hit the IBM talk and seek out the slides for the other two.
More than likely I’d take a break at 13:00 and look at the slides for “Bypass firewalls, application white lists, secure remote desktops under 20 seconds” and “Investigating PowerShell Attacks” later. At 14:00, “What the Watchers See: Eavesdropping on Municipal Mesh Cameras for Giggles (or Pure Evil)“: “…we decode the previously undocumented mesh protocol enough to (1) “tune in” to live feeds from the various cameras positioned across the city, just like we were in police headquarters, and (2) inject arbitrary video into these streams.”
“Am I Being Spied On? Low-tech Ways Of Detecting High-tech Surveillance” sounds like the best talk at 15:00. And after that, there’s nothing that really intrigues me on Friday.
“Hack All The Things: 20 Devices in 45 Minutes” seems like the best opening panel on Saturday: if you don’t like what you’re seeing, just wait and something else will be along shortly. Plus free hardware!
There’s nothing that leaps out at me until “Secure Random by Default” at 13:00. Because Dan Kaminsky. “PropLANE: Kind of keeping the NSA from watching you pee” would be a good fallback if Kaminsky is too crowded: “…we’ve combined two things every good hacker should have, a Propeller powered DEF CON badge (DC XX in our case) and a somewhat sober brain to turn the DC badge (with some modifications) into an inline network encryption device.” (And hey: I have a DC 20 badge!)
“Secure Random” runs until 15:00, but if I couldn’t get into that, “NinjaTV – Increasing Your Smart TV’s IQ Without Bricking It” would be my second choice in the 14:00 block.
“A Survey of Remote Automotive Attack Surfaces” is at 15:00. This is another Charlie Miller and Chris Valasek talk, and is already getting some press: I kind of want to see this, but, again, there’s a conflict with two other talks I’d also like to see: “VoIP Wars: Attack of the Cisco Phones” and “Detecting Bluetooth Surveillance Systems“. This is another case where I’d apologize profusely to Mr. Miller and Mr. Valasek, download a copy of their presentation, and hit one of the other two sessions.
“Manna from Heaven: Improving the state of wireless rogue AP attacks” sounds interesting, especially with the promise of “a new rogue access point toolkit”. But I just can’t pass up the promise of “Learn how to control every room at a luxury hotel remotely“.
“Attacking the Internet of Things using Time“, which is really about timing attacks, sounds more interesting than the title implies. And “Old Skewl Hacking: Porn Free!” sounds like a great way to wrap up the day.
I don’t know that there’s anything I care that much about Sunday morning, though “Burner Phone DDOS 2 dollars a day : 70 Calls a Minute” and “Optical Surgery; Implanting a DropCam” could be interesting if I was up at that time. “NSA Playset : GSM Sniffing” sounds a bit more interesting: “Introducing TWILIGHTVEGETABLE, our attempt to pull together the past decade of GSM attacks into a single, coherent toolset, and finally make real, practical, GSM sniffing to the masses.”
There’s a gap in stuff I want to see from 13:00 to 15:00. At 15:00, we have “Elevator Hacking – From the Pit to the Penthouse“. I confess to a great deal of curiosity about elevators and how they work. Plus: Deviant Ollam! And that takes us to the closing ceremonies at 16:30.
Tomorrow, I’ll start trying to put up links.
DEFCON 22: 0 day notes (part 1)
Thursday, August 7th, 2014DEFCON 22 sort of fires up today, though the real action doesn’t begin until Friday.
I’m not in Vegas again this year, for boring (money) reasons. Frankly, I’m also feeling a little burnt out. I miss Vegas (well, mostly, I miss Lotus of Siam) but I’m not sure I really miss dealing with that many people crammed into that small a space. I’m also not so sure that what happens at the conference makes that much of a difference any more. It seems like, to borrow the words of another better writer, “Nothing works and nobody cares”.
Or maybe that’s the depression talking. And the fact that my current employer made all of the videos from last year’s DEFCON available internally within a week of the conference.
So. If I was at DEFCON, what would I be attending?
As I said earlier, Thursday is usually kind of slow. I suspect I’d go to the “Data Protection 101 – Successes, Fails, and Fixes” talk; it sounds kind of basic to me, but you never know what you might learn. “Practical Foxhunting 101” also intrigues me. I went transmitter hunting with a friend of mine many many years ago, and I maintain a somewhat more than academic interest in the subject.
“Paging SDR… Why should the NSA have all the fun?” sounds like fun. Basically, this appears to be “how to decode pager traffic with cheap hardware so you can pretend to be Lester Freamon for fun and profit”. On the other hand, this conflicts with “RF Penetration Testing, Your Air Stinks“, a how-to talk for radio frequency penetration testers. I suspect I’d go to this one, and grab the slides from the pager talk later.
I know SCADA and the cloud are hot topics, but I’m not sure I’d go to either “AWS for Hackers” or “Protecting SCADA From the Ground Up“, simply because neither topic interests me that much. Nothing personal, presenters; they just don’t turn my crank.
I like the idea behind “Anatomy of a Pentest; Poppin’ Boxes like a Pro” and would be more likely to hit that than “One Man Shop: Building an effective security program all by yourself“. If I was working in a small organization, though, I’d probably go to “One Man Shop” instead.
Neither “Standing Up an Effective Penetration Testing Team” nor “In the forest of knowledge with 1o57” interests me that much, so I’d take another break here.
I’m slightly more interested in “Reverse Engineering Mac Malware” than I am in the Honeynets talk. And “RFIDler: SDR.RFID.FTW” sounds exciting: “We have created a small, open source, cheap to build platform that allows any suitably powerful microprocessor access to the raw data created by the over-the-air conversation between tag and reader coil. The device can also act as a standalone ‘hacking’ platform for RFID manipulation/examination.”
This is shaping up to be longer than I expected, so I’m going to break it into two parts. I will try to get a second part up tonight and at least cover the Friday and Saturday talks I’m interested in, if not all the way through to Sunday.
The full schedule is here, if anyone wants to look at it and make requests. I welcome comments from presenters and other people who are at DEFCON. And I will be trying to monitor twitter feeds and posting presentation links as I find them.